UBUNTU-CVE-2026-119429: Medium severity ubuntu/phpmyadmin vulnerability
Published Nov 3, 2026
·Updated
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
Affected Software
8 affected components
ubuntu/phpmyadmin*
ubuntu/phpmyadmin*
ubuntu/phpmyadmin*
ubuntu/phpmyadmin*
ubuntu/phpmyadmin*
ubuntu/phpmyadmin*
ubuntu/phpmyadmin*
ubuntu/phpmyadmin*
Event History
Nov 3, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploitation require an existing phpMyAdmin session?
Yes. The attacker must be authenticated, such as by holding a hijacked session; no user interaction is required.
2
What is the practical impact after a successful attack?
The attacker can remove the configured two-factor authentication setting. Subsequent logins then require only the MySQL password.